In the past two days, a program is written to read System Event Logs. The values of timegenerated and timewritten in the Structure Variable eventlogrecord are:
The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.
That is, the number of seconds from, January 1, January 1, 1970, GMT.
Windows does not seem to provide an API function to convert the function to the corresponding year, month, day, hour, minute, and second.
After Google
Http://www.asmcommunity.net/board/index.php? Topic = 18369.0
I found the method provided by donkey users and sorted it out as follows:
Basetimelow equ 0d53e8000h
Basetimehigh equ 19db1deh
Stamptolocaldatetime proc dwstamp: DWORD, lpstlocaltime: DWORD
Local stutcfiletime: filetime
Local stlocalfiletime: filetime
MoV eax, dwstamp
MoV edX, 10000000
Mul edX
Add eax, basetimelow
ADC edX, basetimehigh
MoV stutcfiletime. dwlowdatetime, eax
MoV stutcfiletime. dwhighdatetime, EDX
Invoke filetimetolocalfiletime, ADDR stutcfiletime, ADDR stlocalfiletime
Invoke filetimetosystemtime, ADDR stlocalfiletime, lpstlocaltime
RET
Stamptolocaldatetime endp
Locale_system_default equ 0
G_szfmtdate DB "yyyy-m-d", 0
Printdate proc lpstdate: DWORD
Local Buf [12]: byte
Invoke getdateformat, locale_system_default, null, lpstdate, offset g_szfmtdate, ADDR Buf, sizeof Buf
M_instxt ADDR Buf
RET
Printdate endp
; Locale_system_default equ 0
G_szfmttime DB "H: M: SS", 0
Printtime proc lpsttime: DWORD
Local Buf [9]: byte
Invoke gettimeformat, locale_system_default, null, lpsttime, offset g_szfmttime, ADDR Buf, sizeof Buf
M_instxt ADDR Buf
RET
Printtime endp
G_szfmtdatetime DB "% d-% d: % d", 0
Printdatetime proc lpstdatetime: DWORD
Local Buf [30]: byte
Pusha
MoV EDI, lpstdatetime
Movzx eax, (systemtime PTR [EDI]). wyear
Movzx EBX, (systemtime PTR [EDI]). wmonth
Movzx ECx, (systemtime PTR [EDI]). wday
Movzx edX, (systemtime PTR [EDI]). whour
Movzx ESI, (systemtime PTR [EDI]). wminute
Movzx EDI, (systemtime PTR [EDI]). wsecond
Invoke wsprintf, ADDR Buf, ADDR g_szfmtdatetime, eax, EBX, ECx, EDX, ESI, EDI
Popa
RET
Printdatetime endp